Linux Kernel EUVD-2026-32479

Local system access with at least low-privilege credentials is required (PR:L per CVSS vector). The vulnerable code path is triggered only when the kernel's TPM2 driver executes tpm2_read_public() - specifically during TPM2 key read operations involving hash algorithm negotiation. The memory leak on the success path can be triggered without any error condition, but requires a TPM2 device to be present and the tpm2 kernel subsystem to be active. Systems without TPM2 hardware or with the TPM2 kernel driver disabled are entirely unaffected. There is no remote or network-accessible attack vector; exploitation is strictly local. Limiting factors include the requirement for a physical or emulated TPM2 device, the tpm2 kernel driver being loaded, and local user access to trigger TPM2 key operations.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a medium score of 5.5, accurately reflecting a local, low-privilege, low-complexity memory exhaustion issue with no confidentiality or integrity impact. The EPSS score of 0.02% (4th percentile) strongly corroborates that exploitation in the wild is unlikely - there is no CISA KEV listing and no known public proof-of-concept code. Real-world risk is further bounded by the requirement for an active TPM2 device and driver on the target system; hosts without TPM2 hardware or with the kernel TPM2 driver disabled are entirely unaffected. Notably, the 'Information Disclosure' tag attached to this CVE in the input data is inconsistent with both the CVE description and the CVSS vector (C:N/I:N/A:H) - the actual impact is purely availability-based memory exhaustion, not information disclosure; that tag should not inform risk decisions. This is a genuine kernel stability and resource-management issue relevant to long-running TPM2-enabled servers but does not represent a high-priority exploitation risk.

A local user with standard (low-privilege) credentials on a Linux server with a TPM2 device repeatedly invokes operations that exercise the tpm2_read_public() code path, such as enumerating or reading TPM2 persistent keys, particularly in contexts where hash algorithm negotiation occurs. Each invocation leaks one page of kernel memory without release, and over thousands of invocations the unreleased allocations accumulate, potentially destabilizing the system or causing an out-of-memory condition. No public proof-of-concept code has been identified at time of analysis.